Two vulnerabilities in VLC Media Player, CVE-2026-56711 and CVE-2026-73324, could allow attackers to compromise memory or extract sensitive information from affected systems This article explores picture buffer allocation. . The flaw in the picture-buffer allocation logic, identified by security researcher Fabian Wahle of Hap Security, occurs when the application calculates the memory required to process image data.
VLC uses 32-bit integer arithmetic while accumulating picture-plane sizes in the AllocatePicture function within src/misc/picture.c. Due to the signed integer fields storing the relevant values, multiplication can overflow and wrap prematurely, reducing the result to a smaller size before being expanded into the larger size_t variable. Consequently, VLC reserves a small heap buffer, even though the decoder later handles image dimensions requiring significantly more memory.
Existing checks fail to reliably halt the condition because one validates values in 64-bit arithmetic, while the vulnerable multiplication occurs at 32 bits. Heap out-of-bounds writes pose significant risks, potentially leading to crashes, data corruption, and, depending on memory layout and exploit mitigations, enabling arbitrary code execution. The bug arises from the RtspReadLine function copying a server response line into a fixed-size buffer with strncpy without ensuring a terminating null byte.
Organizations and users running VLC 3.0.0 through 3.0.23 should be cautious with untrusted PNG files, playlists, and RealRTSP links until an updated release or vendor remediation is available.
